Rails 6.1.x Release Notes

Security Fixes

• CVE-2026-41316 - Fix for ERB vulnerability when using Marshal.load.

Active Record

• CVE-2022-44566 – Resolve incomplete denial-of-service (DoS) fix from earlier release.

Security Fixes

Action View

• CVE-2026-33168 — Fix possible XSS vulnerability in tag helpers.

Active Storage

• CVE-2026-33658 - Fix possible DoS vulnerability in proxy mode via multi-range requests.
• CVE-2026-33202 — Fix possible glob injection in DiskService.
• CVE-2026-33195 — Fix possible path traversal in DiskService.
• CVE-2026-33174 - Fix possible DoS vulnerability in proxy mode via Range requests.
• CVE-2026-33173 — Fix insufficient filtering of metadata in direct uploads.

Active Support

• CVE-2026-33176 — Fix possible DoS vulnerability in number helpers.
• CVE-2026-33170 — Fix possible XSS vulnerability in SafeBuffer#%.
• CVE-2026-33169 — Fix possible ReDoS vulnerability in number_to_delimited.

Security Fixes

Active Record

• CVE-2025-55193 - Call inspect on ids in RecordNotFound error.

Active Storage

• CVE-2025-24293 - Remove dangerous transformations.

Notes

• This is the initial release of Never-Ending Support (NES) for Rails v6.1.x.

Security Fixes

Action Mailer

• CVE-2024-47889 – Avoid regex backtracking in block_format helper.

Action Pack

• CVE-2024-54133 – Fixed a possible Content Security Policy bypass in Action Dispatch.
• CVE-2024-47887 – Fixed a possible ReDoS vulnerability in HTTP Token authentication in Action Controller.
• CVE-2024-41128 – Fixed a possible ReDoS vulnerability in query parameter filtering in Action Dispatch.

Action Text

• CVE-2024-47888 – Fixed a possible ReDoS vulnerability in plain_text_for_blockquote_node in Action Text.